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NONDETERMINISTIC QUANTUM QUERY AND 
COMMUNICATION COMPLEXITIES* 

RONALD DE WOLFt 

Abstract. We study nondeterministic quantum algorithms for Boolean functions /. Such 
algorithms have positive acceptance probability on input x iff f(x) = 1. In the setting of query 
complexity, we show that the nondeterministic quantum complexity of a Boolean function is equal 
to its "nondeterministic polynomial" degree. We also prove a quantum-vs. -classical gap of 1 vs. n for 
nondeterministic query complexity for a total function. In the setting of communication complexity, 
we show that the nondeterministic quantum complexity of a two-party function is equal to the 
logarithm of the rank of a nondeterministic version of the communication matrix. This implies that 
the quantum communication complexities of the equality and disjointness functions are n + 1 if we 
do not allow any error probability. We also exhibit a total function in which the nondeterministic 
quantum communication complexity is exponentially smaller than its classical counterpart. 
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1. Introduction. 

1.1. Motivation. In classical computing, nondeterministic computation has a 
prominent place in many different models and for many good reasons. For example, in 
Turing machine complexity, the study of nondeterminism leads naturally to the class 
of NP-complete problems, which contains some of the most important and practically 
relevant computer science problems — as well as some of the hardest theoretical open 
questions. In fields like query complexity and communication complexity, there is a 
tight relation between deterministic complexity and nondeterministic complexity, but 
it is often much easier to analyze upper and lower bounds for the latter than for the 
former. 

Suppose we want to compute a Boolean function / in some algorithmic setting, 
such as that of Turing machines, decision trees, or communication protocols. Consider 
the following two ways of viewing a nondeterministic algorithm. The first and most 
common way is to think of it as a "certificate verifier" : a deterministic algorithm A 
that receives, apart from the input x, a "certificate" y whose validity it needs to 
verify. For all inputs x, if f(x) = 1, then there is a certificate y such that A(x, y) = 1; 
if f(x) = 0, then A{x,y) = for all y. Second, we may view A as a randomized 
algorithm whose acceptance probability is positive if f(x) = 1 and whose acceptance 
probability is zero if fix) — 0. It is easy to see that these two views are equivalent 
in the classical case. To turn an algorithm A of the first kind into one of the second 
kind, we can just guess a certificate y at random and output A(x,y). This will have 
positive acceptance probability iff f(x) = 1. For the other direction, we can consider 
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the sequence of coin flips used by an algorithm of the second kind as a certificate. 
Clearly, there will be a certificate leading to output 1 iff f(x) = 1, which gives us an 
algorithm of the first kind. 

Both views may be generalized to the quantum case, yielding three potential 
definitions of nondeterministic quantum algorithms, possibly noncquivalcnt. The 
quantum algorithm may be required to output the right answer f(x) when given 
an appropriate certificate, which we can take to be either quantum or classical. Or, 
third, the quantum algorithm may be required to have positive acceptance proba- 
bility iff f{x) = 1. An example is given by two alternative definitions of quantum 
nondctcrminism in the case of quantum Turing machine complexity Kitaev defines 
the class "bounded-error quantum-NP" (BNQP) as the set of languages accepted by 
polynomial-time bounded-error quantum algorithms that are given a polynomial-size 
quantum certificate (e.g., [32, 31] and [30, Chapter 14]). On the other hand, Adleman, 
Demarrais, and Huang [2] and Fenner et al. [24] define quantum-NP as the set of lan- 
guages L for which there is a polynomial-time quantum algorithm whose acceptance 
probability is positive iff a; G L. This quantum class was shown to be equal to the 
classical counting class co-C = P [24, 52] using tools from Fortnow and Rogers [25]. 

In this paper, we adopt the latter view: a nondeterministic quantum algorithm 
for / is defined to be a quantum algorithm that outputs 1 with positive probability 
if f(x) = 1 and that always outputs if f(x) = 0. This definition contrasts with 
the more traditional view of classical determinism as "certificate verification." The 
motivation for our choice of definition of quantum nondeterminism is twofold. First, 
in the appendix, we show that this definition is strictly more powerful than the other 
two possible definitions in the sense of being able to simulate the other definitions 
efficiently while the reverse is not true. Second, it turns out that this definition lends 
itself to very crisp results. Rather than in the quantum Turing machine setting of 
Kitaev, Adleman, etc., we study the complexity of nondeterministic algorithms in 
the query complexity and communication complexity settings. Our main results are 
exact characterizations of these nondeterministic quantum complexities in algebraic 
terms and large gaps between quantum and classical complexities in both settings. 
Our algebraic characterizations can be extended to nontotal functions in the obvious 
way, but we will stick to total functions in our presentation. 

1.2. Query complexity. We first consider the model of query complexity, also 
known as decision tree complexity or black box complexity. Here the goal is to com- 
pute some function / : {0, 1}™ — > {0, 1}, making as few queries to input bits as 
possible. Most existing quantum algorithms can naturally be expressed in this model 
and achieve provable speed-ups over the best classical algorithms. Examples can be 
found, e.g., in [22, 48, 26, 12, 13, 14] and also include the order-finding problem on 
which Shor's celebrated factoring algorithm is based [47]. 

Let D(f) and Qe{J) denote the query complexities of optimal deterministic and 
quantum algorithms that compute / exactly. Let deg(f) denote the minimal degree 
among all multilinear polynomials that represent /. (A polynomial p represents / 
if f(x) = p(x) for all x G {0, 1}™.) The following relations are known. The first 
inequality is due to Beals et al. [6], the second inequality is obvious, and the last is 
due to Nisan and Smolensky — unpublished, but described in the survey paper [20]. 

6 ^f L < Qe(!) < D(f) < 0(deg{ff). 
Thus deg(f), Qe(/), and D(f) are polynomially related for all total /. (The situation 
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is very different for partial / [22, 48, 47, 7].) Nisan and Szegedy [42] exhibit a function 
with a large gap between D(f) = n and deg(f) = n 6 ", but no function is known 
where Qe{J) is significantly larger than deg(f), and it may in fact be true that Qe{J) 
and deg(f) are linearly related. In section 2, we show that the nondeterministic 
versions of Qe(J) and deg(f) are in fact equal: 

NQ(f) = ndeg(f). 

Here NQ(f) denotes the query complexity of an optimal nondeterministic quantum 
algorithm for /, which has nonzero acceptance probability iff f(x) = 1. The non- 
deterministic degree ndeg(f) is the minimal degree of a so-called nondeterministic 
polynomial for /, which is required to be nonzero iff f(x) = 1. A note on termi- 
nology: the name "nondeterministic polynomial" is based only on analogy with the 
acceptance probability of a nondeterministic algorithm. This name is less than ideal, 
since such polynomials have little to do with the traditional view of nondeterminism 
as certificate verification. Nevertheless, we use this name because any alternatives 
that we could think of were worse (too verbose or confusing) . 

Apart from the algebraic characterization of the nondeterministic quantum query 
complexity NQ(f), we also show that NQ(f) may be much smaller than its classical 
analogue N(f): we exhibit an / where NQ(f) = 1 and N(f) = n, which is the 
biggest possible gap allowed by this model. Accordingly, while the case of exact (or, 
for that matter, bounded-error) computation allows at most polynomial quantum- 
classical query complexity gaps for total functions, the nondeterministic case allows 
unbounded gaps. 

1.3. Communication complexity. In the case of communication complexity, 
the goal is for two distributed parties, Alice and Bob, to compute some function 
/ : {0,1}" x {0,1}™ — ► {0,1}. Alice receives an x £ {0,1}™, and Bob receives a 
y € {0, 1}™, and they want to compute f(x, y), exchanging as few bits of communica- 
tion as possible. This model was introduced by Yao [53] and is fairly well understood 
for the case in which Alice and Bob are classical players exchanging classical bits [36] . 
Much less is known about quantum communication complexity, where Alice and Bob 
have a quantum computer and can exchange qubits. This was first studied by Yao [54] , 
and it was shown later that quantum communication complexity can be significantly 
smaller than classical communication complexity [21, 17, 5, 44, 16]. 

Let Dcc(f) and Qcc E (f) denote the communication required for optimal deter- 
ministic classical and exact quantum protocols for computing /, respectively. 1 Here 
we assume Alice and Bob do not share any randomness or prior entanglement. Let 
rank(f) be the rank of the 2™ x 2™ communication matrix Mf, which is defined by 
Mf(x,y) = f(x,y). The following relations are known: 

l ^f^l < Qcc E (f) < Deetf). 

The first inequality follows from work of Kremer [35] and Yao [54] , as first noted by 
Buhrman, Cleve, and Wigderson [17]. (In [19] it is shown that this lower bound also 
holds if the quantum protocol can make use of unlimited prior entanglement between 
Alice and Bob.) It is an open question whether Dcc(f) can in turn be upper bounded 

1 The notation D(f) is used for deterministic complexity in decision tree complexity as well 
as in communication complexity. To avoid confusion, we will consistently add "cc" to indicate 
communication complexity. 
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by some polynomial in log rank(f). The conjecture that it can is known as the log-rank 
conjecture. If this conjecture holds, then Dcc(f) and Qcc E (f) are polynomially related 
for all total / (which may well be true). It is known that log rank(f) and Dcc(f) are 
not linearly related [43]. In section 3, we show that the nondeterministic version of 
log rank(f) in fact fully determines the nondeterministic version of Qcc E (f): 

NQcc(f) = \log nrank(f)~\ + 1. 

Here nrank(f) denotes the minimal rank of a matrix whose (x, y)-entry is nonzero iff 
f(x,y) = 1. Thus we can characterize the nondeterministic quantum communication 
complexity fully by the logarithm of the rank of its nondeterministic matrix. As far as 
we know, only two other log-rank-style characterizations of certain variants of commu- 
nication complexity are known: the communication complexity of quantum sampling 
due to Ambainis et al. [5] and the so-called modular communication complexity due 
to Meinel and Waack [38]. 

Equality and disjointness both have nondeterministic rank 2", so their nondeter- 
ministic complexities are maximal: NQcc(EQ) = NQcc(DlSJ) = n+1. Since NQcc(f) 
lower bounds Qcc E (f), we also obtain optimal bounds for the exact quantum com- 
munication complexity of equality and disjointness. In particular, for the equality 
function, we get Qcc E (EQ) = n+1, which answers a question posed by Gilles Bras- 
sard in a personal communication [10]. Surprisingly, no proof of this fact seems to be 
known that avoids our detour via nondeterministic computation. Thus our methods 
also give new lower bounds for regular quantum communication complexity. 

Finally, analogous to the query complexity case, we also show an exponential 
gap between quantum and classical nondeterministic communication complexity: we 
exhibit an / where NQcc(f) < log(n + 1) + 1 and Ncc(f) E fi(ra). Massar et al. [37] 
earlier found another gap that is unbounded, yet in some sense smaller: NQcc(NE) = 2 
versus TVcc(NE) = logn + 1, where NE is the nonequality function. 

2. Nondeterministic quantum query complexity. 

2.1. Functions and polynomials. For x € {0, 1}™, we use |x| for the Hamming 
weight (number of l's) of x, and Xj for its ith bit, i £ [n] = {1, . . . , n}. We use for a 
string of n zeros. If B C [n] is a set of (indices of) variables, then x B denotes the input 
obtained from x by complementing all variables in B. If x,y G {0, 1}™, then x A y 
denotes the n-bit string obtained by bitwise ANDing x and y. Let / : {0, 1}" — > {0, 1} 
be a total Boolean function. For example, OR(x) = 1 iff |x| > 1, AND(x) = 1 iff 
|x| = n, PARITY(x) = 1 iff |x| is odd. We use / for the function 1 — /. 

For b £ {0,1}, a b-certificate for / is an assignment C : S — > {0,1} to some 
set S of variables, such that f(x) — b whenever x is consistent with C. The size 
of C is \S\. The certificate complexity C x (f) of / on input x is the minimal size of 
an /(x)-certificate that is consistent with x. We define the 1-certificate complexity 
of / as C^\f) = max x .fr x \=iC x (f). We define C^(f) similarly. For example, 
C«(OR) = 1 and (7< >(OR) = n, but C«(OR) = n and £7<°>(OR) = 1. 

An n-variate multilinear polynomial is a function p : C" — > C that can be written 

P( x ) = X! a s x s- 

SC[n] 

Here S ranges over all sets of indices of variables, as is a complex number, and 
the monomial X$ is the product H ie sXi of all variables in S. The degree deg(p) 
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of p is the degree of a largest monomial with nonzero coefficient. It is well known 
that every total Boolean / has a unique polynomial p such that p(x) = f(x) for 
all x <G {0,1}". Let deg(f) be the degree of this polynomial, which is at most n. 
For example, OR(xi,X2) — x\ + x 2 — X1X2, which has degree 2. Every multilinear 
polynomial p — J2 S 0,3X3 can also be written out uniquely in the so-called Fourier 
basis: 

P (x) = j2cs(-ir s . 

s 

Again S ranges over all sets of indices of variables (we often identify a set S with 
its characteristic n-bit vector), C5 is a complex number, and x ■ S denotes the inner 
product of the n-bit strings x and S, or, equivalently, x ■ S = \x A S\ = J2ies Xi - 
It is easy to see that deg(p) = max-flS*! | eg 7^ 0}. For example, OR(xi,:e2) = 
I - i(-!) Xl - \{- l ) X2 - \(-l) Xl+X2 in the Fourier basis. We refer to [8, 42, 20] for 
more details about polynomial representations of Boolean functions. 

We introduce the notion of a nondeterministic polynomial for /. This is a poly- 
nomial p such that p(x) 7^ iff f(x) = 1. Let the nondeterministic degree of /, 
denoted ndeg(f), be the minimum degree among all nondeterministic polynomials p 
for /. For example, p(x) = J2"=i 

nondeterministic polynomial for OR; hence 

ndeg{OK) = 1. 

We mention some upper and lower bounds for ndeg(f). Let / be a nonconstant 
symmetric function (i.e., f(x) depends only on Suppose / achieves value 

on the z Hamming weights, k\, . . . ,k z . Since \x\ = X^ 2 -^ ^ is easy to see that 
(|x| — fci)(|x| — fc 2 ) • • • (\x\ — k z ) is a nondeterministic polynomial for /; hence ndeg(f ) < 
z. This upper bound is tight for AND (see below) but not for PARITY. For example, 
p{x\,x-2) = x\ — X2 is a dcgrcc-1 nondeterministic polynomial for PARITY on two 
variables: it assumes value on x- weights and 2 and ±1 on weight 1. By squar- 
ing p{x) and then using standard symmetrization techniques (as used, for instance, 
in [39, 42, 6]), we can also show the general lower bound ndeg(f) > z/2 for symmet- 
ric /. Furthermore, it is easy to show that ndeg(f) < C^'(f) for every /. (Take a 
polynomial that is the "sum" over all I-certificates for /.) 

Finally, we mention a general lower bound on ndeg(f). Let Pr[p ^ 0] = 
|{a; € {0, 1}" I p(x) 7^ 0}|/2" denote the probability that a random Boolean input x 
makes a function p nonzero. A lemma of Schwartz [46] (see also [42, section 2.2]) states 
that if p is a nonconstant multilinear polynomial of degree d, then Pr[p 7^ 0] > 2~ d , 
and hence d > log(l/Pr[p 7^ 0]). Since a nondeterministic polynomial p for / is 
nonzero iff f(x) = I, it follows that 

ndeg(f) > log(l/Pr[/ ^ 0]) = log(l/Pr[/ = I]). 

Accordingly, functions with a very small fraction of 1-inputs will have high nondeter- 
ministic degree. For instance, Pr[AND = I] = 2~", so ndeg(AND) = n. 

2.2. Quantum computing. We assume familiarity with classical computation 
and briefly sketch the setting of quantum computation (see, e.g., [40] for more details). 
An m-qubit state is a linear combination of all classical m-bit states 

\4>) = ^1*)' 

ie{o,i} m 

where \i) denotes the basis state i (a classical m-bit string) and on is a complex 
number that is called the amplitude of \i). We require J2i \ a i\ 2 = 1- Viewing \4>) as 
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a 2 m -dimensional column vector, we use (0| for the row vector that is the conjugate 
transpose of \<f>). Note that the inner product (i\\j) = is 1 if i = j and if 
i 7^ j. When we observe \4>), we will see \i) with probability |(i|</>)| 2 = \oti\ 2 , and 
the state will collapse to the observed \i). A quantum operation which is not an 
observation corresponds to a unitary (i.e., norm-preserving) transformation U on the 
2 m -dimensional vector of amplitudes. 

2.3. Query complexity. Suppose we want to compute some function / : 
{0, 1}™ — > {0, 1}. For input x G {0, 1}™, a query corresponds to the unitary transfor- 
mation O that maps |i,6, z) — > \i,b(B Xi,z). Here i G [n] and b G {0, 1}; the z-part 
corresponds to the workspace, which is not affected by the query. We assume that 
the input can be accessed only via such queries. A T-query quantum algorithm has 
the form A — UtOUt-i • • • OUiOUo, where the Uk are fixed unitary transforma- 
tions, independent of the input x. This A depends on x via the T applications of O. 
We sometimes write A x to emphasize this. The algorithm starts in initial state |0), 
and its output is the bit obtained from observing the leftmost qubit of the final su- 
perposition A\Q). The acceptance probability of A (on input x) is its probability of 
outputting 1 (on x). 

We will consider classical and quantum algorithms and will count only the number 
of queries these algorithms make on a worst-case input. Let D(f) and Qe(I) be the 
query complexities of optimal deterministic classical and exact quantum algorithms 
for computing /, respectively. D{f) is also known as the decision tree complexity 
of /. Similarly we can define i?2(/) and Q2U) to be the query complexity of / 
for bounded-error classical and quantum algorithms, respectively. Quantum query 
complexity and its relation to classical complexity has been well studied in recent 
years; see, for example, [6, 4, 20]. 

We define a nondeterministic algorithm for / to be an algorithm that has positive 
acceptance probability on input x iff f(x) = 1. Let N(f) and NQ(f) be the query 
complexities of optimal nondeterministic classical and quantum algorithms for /, re- 
spectively. It is easy to show that the 1-certificate complexity fully characterizes the 
classical nondeterministic complexity of /. 

Proposition 2.1. N(f) = C (1 \f).' 

Proof. A classical algorithm that guesses a 1-certificate, queries its variables, 
and outputs 1 iff the certificate holds is a nondeterministic algorithm for /. Hence 
N{f)<CW(f). 

A nondeterministic algorithm for / can only output 1 if the outcomes of the 
queries that it has made force the function to 1. Hence, if x is an input where all 
1-certificates have size at least C^ 1 ^/), then the algorithm will have to query at least 
C^\f) variables before it can output 1 (which it must do on some runs). Hence 
A(/)>C«(/). □ 

2.4. Algebraic characterization. Here we show that NQ(f) is equal to ndeg(f), 
using the following result from [6]. 

Lemma 2.2 (see [6]). The amplitudes of the basis states in the final superposition 
of a T-query quantum algorithm can be written as multilinear complex-valued polyno- 
mials of degree < T in the n Xi-variables. Therefore, the acceptance probability of the 
algorithm (which is the sum of squares of some of those amplitudes) can be written as 
an n-variate multilinear polynomial P{x) of degree < IT . 

Note that the acceptance probability of a nondeterministic quantum algorithm 
is actually a nondeterministic polynomial for /, since it is positive iff f(x) — 1. By 
Lemma 2.2, this polynomial will have degree at most twice the number of queries 
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of the algorithm, which immediately implies ndeg(f)/2 < NQ(f). Below we will 
show how we can get rid of the factor 1/2 in this lower bound, improving it to 
ndeg(f) < NQcc(f). We show that this lower bound is in fact optimal by deriving a 
nondcterministic algorithm from a nondctcrministic polynomial. This derivation uses 
a trick similar to the one used in [24] to show that co-C = P C quantum-NP. 
Theorem 2.3. NQ(f) = ndeg(f). 

Proof. Upper bound. Let p(x) be a nondeterministic polynomial for / of degree 
d = ndeg(f). Recall that x-S 1 denotes |xAS|, identifying S C [n] with its characteristic 
n-bit vector. We write p in the Fourier basis: 



x-S 



Since deg(p) = max{|5| | c$ ^ 0}, we have that c$ ^ only if \S\ < d. 

We can construct a unitary transformation F that uses d queries to x and maps 
IS*) — > (— l) 1 ' 5 ^) whenever \S\ < d. Informally, this transformation does a controlled 
parity-computation: it computes \x- S\ (mod 2) using \S\/2 queries [6, 23], then adds 
a phase "—1" if that answer is 1, and then reverses the computation to clean up the 
workspace and the answer at the cost of another \S\/2 queries. (If |5| is odd, then 
one variable is treated separately, still using |5| queries in total.) 

Now consider the following quantum algorithm: 

1. Start with c^2 s cs\S) (an n-qubit state, where c = l/\/J2s \ c s\ 2 * s a nor " 
malizing constant). 

2. Apply F to the state. 

3. Apply a Hadamard transform H to each qubit. 

4. Measure the final state, and output 1 if the outcome is the all-zero state |0), 
and output otherwise. 

The state after step 2 is cj^s c s{— l) x S \S). Note that the sum of the amplitudes in 
this state is c-p(x), which is nonzero iff f(x) = 1. The Hadamard transform in step 3 
gives us this sum as amplitude of the |0)-state, with a normalizing factor of l/\/2". 
Accordingly, the probability of observing |0) at the end is 



P(x) = 



{0\H® n FcJ2cs\S} 

s 

]T(s'i5>(-ir s is> 



c 

2™ 



c 

On 

" S 

c 2 p(x) 2 



£ cs (-ir< 



2" 

Since p{x) is nonzero iff f(x) = 1, P(x) will be positive iff f(x) = 1. Hence we have 
a nondeterministic quantum algorithm for / with d = ndeg(f) queries. 

Lower bound. Let T = NQ(f), and consider a T-query nondcterministic quantum 
algorithm for /. By Lemma 2.2, the amplitudes in the final state, 



\^) =Y^a i (x)\i), 

i 
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on input x are n-variate polynomials of x of degree < T. We use the probabilistic 
method [3] to show that some linear combination of these polynomials is a nondc- 
terministic polynomial for /, thus avoiding losing the factor 1/2 mentioned after 
Lemma 2.2. 

Let S be the set of basis states having a 1 as leftmost bit (observing such a state 
will lead the algorithm to output 1). Since the algorithm is nondeterministic, we have 
the following properties: 

If f{x) = 0, then a t {x) = for all i e S. 

If f(x) = 1, then a.i{x) ^ for at least one i G S. 
Let I be an arbitrary set of more than 2™ numbers. For each i G S, pick a coefficient c, 
uniformly at random from I, and define p(x) = J^ieS c i a i( x )- By the first property, 
we have p(x) = whenever f(x) — 0. Now consider an x for which f(x) — 1, and let 
k G S satisfy a = at{x) ^ 0. Such a k must exist by the second property. We want to 
show that the event p(x) = happens only with very small probability (probability 
taken over the random choices of the Cj). In order to do this, we fix the random 
choices a for all i ^ k and view p(x) = ack + b as a linear function in the only 
not-yet-chosen coefficient Cfe. Since a ^ 0, at most one out of |/| > 2™ many possible 
choices of can make p{x) — 0, so 

Pr\p(x) = 0] < 2- n . 

However, then, by the union bound we have 

Pr [there is an x G /~ (1) for which p{x) = 0] 

< Prb^) = 0] < 2" • 2~" = 1. 

xe/-i(i) 

This probability is strictly less than 1 , which shows that there exists a way of setting 
the coefficients a that satisfies p(x) ^ for all x G / _1 (1), thus making p a nondeter- 
ministic polynomial for /. Since p is a sum of polynomials of degree < T, it follows 
that ndeg(f) < deg{p) < T = NQ(f). □ 

2.5. Quantum-classical separation. What is the biggest possible gap between 
quantum and classical nondeterministic query complexity? Consider the total Boolean 
function / : {0, 1}" -» {0, 1} defined by 

f(x) = 1 iff \x\ + 1. 

It is easy to see that N(f) = C^\f) = C^°\f) = n. On the other hand, the following 
is a degree- 1 nondeterministic polynomial for /: 

( n \ n 

Thus we have that NQ(f) = ndeg(f ) = 1. Explicitly, the 1-query algorithm that we 
get from the proof is as follows: 

1. Start with c((n/2 - 1)|0) - (1/2) £\ |e 4 )), where c = 1/^2/4-3^4+1 
and |e») has a 1 only at the ith bit. 

2. Using one query, we can map |e») — » (— l) 1 ^^). 

3. Applying a Hadamard transform turns the amplitude of |0) into = 
^((n/2-1)- Ei(-l) Xi /2) =cp{x)/V^. 
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4. Hence the probability of observing |0) at the end is oii = c 2 p(x) 2 /2™. 

For the complement of /, we can easily show NQ(f) = ndeg(f) > n — 1 (the "—1" is 
tight for n = 2; witness p(x) = x\ — x 2 )- In sum, we have the following theorem. 

Theorem 2.4. For the above f, we have NQ(f) = 1, NQ(f) > n - 1, and 
N(f) = N(f) = n. 

2.6. Relation to some other complexity measures. Many relations arc 
known between all sorts of complexity measures of Boolean functions, such as polyno- 
mial degree, certificate complexity, various classical and quantum decision tree com- 
plexities, etc. A survey may be found in [20]. In this subsection, we will similarly 
embed ndeg(f) (= NQ(f)) in this web of relations and give upper bounds on D(f) 
in terms of ndeg(f), C(/), and the block sensitivity bs(f), which is defined as fol- 
lows. A set of (indices of) variables B C [n] is called a sensitive block for / on 
input x if f(x) ^ f(x B ); B is minimal if no B' C B is sensitive. The block sensi- 
tivity bs x (f) is the maximal number of disjoint minimal sensitive blocks in x, and 

bs(b) (f) = m axxe/-!(6) bs x{.f)- 

Lemma 2.5. If f(x) — and B is a minimal sensitive block for f on x, then 
\B\ < ndeg(f). 

Proof. Assume without loss of generality that x — 0. Because B is minimal, for 
every proper subset B' of B, we have f(x) = f(x B ) = 0, but on the other hand 
f(x B ) — 1. Accordingly, if we fix all variables outside of B to zero, then we obtain 
the AND-function of\B\ variables, which requires nondeterministic degree \B\. Hence 
\B\ < ndeg(f). □ 

Lemma 2.6. C^(f) < &s (0) (f)ndeg(f). 

Proof. Consider any input x. As Nisan [41] proved, the union of a maximal set 
of sensitive blocks forms a certificate for that input (for otherwise there would be one 
more sensitive block). If f(x) — 0, then there can be at most bs^°\f) disjoint sensitive 
blocks, and by the previous lemma each block contains at most ndeg(f) variables. 
Hence each 0-input contains a certificate of at most bs^°\f)ndeg(f) variables. □ 

The following theorem improves upon an argument of Nisan and Smolensky, de- 
scribed in [20]. 

Theorem 2.7. D(f) < C^(f)ndeg(f). 

Proof. Let p be a nondeterministic polynomial for / of degree d = ndeg(f). Note 
that if we take a 0-certificate C : S — > {0, 1} and fix the 5-variables accordingly, 
then p must reduce to the constant-0 polynomial. This implies that S intersects all 
degvee-d monomials of p, because a nonintersected degree-d monomial would still be 
present in the reduced polynomial, which would then not be constant-0. Thus taking 
a minimal 0-certificate and querying its variables reduces the degree of p by at least 1 . 
Repeating this at most ndeg(f) times, wc reduce p to a constant polynomial and know 
f(x). This algorithm takes at most (f)ndeg(f) queries. □ 

Combining this with the fact that bs {0) (f) < 6Q 2 (/) 2 [6], we obtain the following. 

Corollary 2.8. £>(/) < bs (0) (f)ndeg(f) 2 < 6 Q 2 (f) 2 NQ(f) 2 . 

This corollary has the somewhat paradoxical consequence that if the nondetermin- 
istic complexity NQ(f) is small, then the bounded-error complexity Qz{f) must be 
large (i.e., close to £>(/)). For instance, if NQ(f) = 0(1), then Q 2 (f) = h(y/D(f)). 
We hope that this result will help tighten the relation D(f) = 0(<?2(/) 6 ) that was 
proved in [6] . 
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3. Nondeterministic quantum communication complexity. 

3.1. Communication complexity. In the standard version of communica- 
tion complexity, two parties (Alice and Bob) want to compute some function / : 
{0,1}™ x {0,1}" -» {0,1}. For example, EQ(x,y) = 1 iff x = y, NE(x,y) = 1 iff 
x y, and DISJ(x,y) = 1 iff \x A y\ = 0. A rectangle is a subset R = S x T of the 
domain of /. R is a 1-rectangle (for /) if f(x,y) = 1 for all (x,y) € R. A l-cover 
for / is a set of 1-rectangles whose union contains all 1-inputs of /. Cov 1 (f ) denotes 
the minimal size (i.e., minimal number of rectangles) of a l-cover for /. Similarly, we 
define 0-rectangles, 0-covers, and Cov (/). 

The communication matrix Mf of / is the 2™ x 2 n Boolean matrix whose (a;, y)- 
cntry is f(x, y), and rank(f) denotes the rank of Mf over the field of complex numbers. 
A 2™ x 2 n matrix M is called a nondeterministic communication matrix for / if it 
has the property that M(x,y) ^ iff f(x,y) = 1. Thus M is any matrix obtainable 
by replacing 1-entries in Mf by nonzero complex numbers. Let the nondeterministic 
rank of /, denoted nrank(f), be the minimum rank (over the complex field) among 
all nondeterministic matrices M for /. 

We consider classical and quantum communication protocols and count only the 
amount of communication (bits or qubits) that these protocols make on a worst- 
case input. For classical communication protocols, we refer to [36]. Here we briefly 
define quantum communication protocols, referring to the surveys [49, 15, 33, 11, 51] 
for more details. The space in which the quantum protocol works consists of three 
parts: Alice's part, the communication channel, and Bob's part. (We do not write 
the dimensions of these spaces explicitly.) Initially these three parts contain only 
0-qubits, 

|0)|0)|0). 

We assume Alice starts the protocol. She applies a unitary transformation Uf(x) to 
her private space and part of the channel. This corresponds to her initial computation 
and her first message. The length of this message is the number of channel qubits on 
which Ui(x) acts. The total state is now 

{u*{x)®i B m\m, 

where <g> denotes tensor product, and I B denotes the identity transformation on Bob's 
part. Then Bob applies a unitary transformation U^iy) = V-P(y)S2 to his part 
and the channel. First, the operation S B "reads" Alice's message by swapping the 
contents of the channel with some fresh |0)-qubits in Bob's private space. After this, 
the unitary V B (y) is applied to Bob's private space and part of the channel. This 
corresponds to Bob's private computation and his putting a message to Alice on the 
channel. The length of this new message is the number of channel-qubits on which 

2 This definition looks somewhat similar to the definition of the Colin de Verdiere parameter fi(G) 
of an undirected graph G [27]. For G = (V, E) with \V\ = n, £t(G) is defined to be the maximal 
corank (= n — rank) among all real symmetric n X n matrices M having the following three properties: 
(1) Mfj < if (i, j) 6 E and Mij = if i ^ j and E; (2) M has exactly one negative eigenvalue 

of multiplicity 1; (3) there is no real symmetric matrix X ^ such that MX = and Xfj = 
whenever i = j or Mij ^ 0. Such a matrix M is a nondeterministic matrix for the communication 
complexity problem / : [n] X [n] — » {0, 1} defined by f(i,j) = 1 iff 6 E, with the promise that 

the inputs i and j are distinct. However, the Colin de Verdiere requirement appears to be more 
stringent, since it constrains the nondeterministic matrix further by properties (2) and (3). 
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V^(y) acts. This process goes back and forth for some k messages, so the final state 
of the protocol on input (x, y) will be (in case Alice goes last as well) 

(Uf(x) ® I B )(I A ® UtM) ■ ■ ■ (I A ® Ui{y)){Uf{x) ® I s )|0)|0)|0). 

The total cosf of the protocol is the total length of all messages sent, on a worst-case 
input (x, y). For technical convenience, we assume that at the end of the protocol the 
output bit is the first qubit on the channel. Thus the acceptance probability P(x, y) of 
the protocol is the probability that a measurement of the final state gives a "1" in the 
first channel-qubit. Note that we do not allow intermediate measurements during the 
protocol. This is without loss of generality; it is well known that such measurements 
can be postponed until the end of the protocol at no extra communication cost. 

Let Dcc(f) and Qcc E (f) be the communication complexities of optimal determin- 
istic classical and quantum protocols for computing /, respectively. A nondeterminis- 
tic protocol for / is a protocol that has positive acceptance probability on input (x, y) 
iff f(x,y) = 1. Let Ncc(f) and NQcc(f) be the communication complexities of opti- 
mal nondeterministic classical and quantum protocols for /, respectively. Our Ncc(f) 
is called N^f) in [36]. 

It is not hard to show that Ncc(f) = [log Cov 1 (f)~\ + 1, where the "+1" is due 
to the fact that we want Alice and Bob both to know the output at the end of the 
protocol. 

3.2. Algebraic characterization. Here we characterize NQcc(f) in terms of 
nrank(f). We use the following lemma. It was stated without proof by Yao [54] and in 
more detail by Kremer [35] and is key to many of the earlier lower bounds on quantum 
communication complexity as well as to ours. It is easily proven by induction on I. 

Lemma 3.1 (see Yao [54] and Kremer [35]). The final state of an l-qubit protocol 
on input (x, y) can be written as 

£ \Mx))\it)\Bi{v)), 
ie{o,iy 

where the Ai (x) , E>i (y) are vectors ( of norm < 1), and ig denotes the last bit of the 
l-bit string i (the output bit). 

The acceptance probability P(x, y) of the protocol is the squared norm of the part 
of the final state that has ig — 1. Letting aij be the 2"-dimensional complex column 
vector with the inner products (Ai(x)\Aj(x)) as entries and bij the 2™-dimensional 
column vector with entries (P>i(y)\Bj(y)), we can write P (viewed as a 2" x 2" matrix) 
as the sum V- - - ■ , aw, 6^ of 2 2l ~ 2 matrices, each of rank at most 1, so the rank 
of P is at most 2 2l ~ 2 . For example, for exact protocols this gives immediately that 
(■ > \ l°g rank(f) + 1, and for nondeterministic protocols I > \ \ognrank{f) + 1. 

Below we show how we can get rid of the factor ^ in the nondeterministic case 
and show that the lower bound of \ognrank(f) + 1 is actually optimal. The lower 
bound part of the proof relies on the following technical lemma. 

Lemma 3.2. If there exist two families of vectors {Ai(x), . . . , A m (x)} C C d and 
{Bi(y), . . . , B m (y)} C C d such that, for all x G {0, 1}™ and y G {0, 1}™, we have 

m 

M{x) ® Bi(y) = iff f(x, y) = 0, 

i=l 

then nrank(f) < m. 
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Proof. Assume there exist two such families of vectors. Let Ai(x)j denote the jth 
entry of vector A^{x), and similarly let B^y) k denote the fcth entry of vector Bi(y). 
We use pairs (j, k) e {I,...,d} 2 to index entries of vectors in the cZ 2 -dimensional 
tensor space. Note that 

if f(x,y) = 0, then Yh=\ A l (x) j B i (y) k = for all (j, fc), and 
if f{x,y) = 1, then YhLi A l {x) j B i (y) k ± for some (j,k). 
As a first step, we want to replace the vectors Ai(x) and Bi(y) by numbers a,i(x) 
and bi(y) that have similar properties. We use the probabilistic method to show that 
this can be done. 

Let I be an arbitrary set of 2 2n+1 numbers. Choose coefficients ai, . . . , ay and 
, /3<j, each coefficient picked uniformly at random from I. For every a; define 
a i( x ) — Sj=i an< i f° r every y define &j(y) = X)fc=i PkBi(y) k - Consider the 

number 

m d / m \ 

v{x,y) = ^ j a i {x)b i {y) = ^ a^ k y^Ai(x)jBi(y) k J . 

i=l j,fc=l \t=l / 

If /(a;, y) = 0, then w(a;, y) = for all choices of the aj,(3 k . 

Now consider some (x, y) with f(x,y) = 1. There is a pair (j',k r ) for which 
SZli Ai(x)j' Bi(y) k i 7^ 0. We want to prove that v(x,y) = happens only with 
very small probability. In order to do this, fix the random choices of all ctj, j ^ j' , 
and fi k , k ^ fc', and view v(x,y) as a function of the two remaining not-yet-chosen 
coefficients a = aj> and /? = /?£/, 

y) = c O!/3 + cia + c 2 /3 + c 3 . 

Here we know that c = Ai(x)j>Bi(y) k > ^ 0. There is at most one value of a 

for which coo; + c 2 = 0. All other values of a turn y) into a linear equation in (3, 
so for those a there is at most one choice of (3 that gives v(x,y) — 0. Hence out of 
the (2 2n+1 ) 2 different ways of choosing {a, /?), at most 2 2n+1 + (2 2n+1 - 1) ■ 1< 2 2 ™+ 2 
choices give v(x, y) = 0. Therefore, 

92n+2 

Pr K^) = 0] < = 2- 2 «. 

Using the union bound, we now have 

Pr [there is an (x, y) G for which v(x, y) = 0] 

< P*Wx, V) = 0] < 2 2 " • 2~ 2 " = 1. 

This probability is strictly less than 1, so there exist sets {ai(x), . . . , a m (x)} and 
{b\(y), . . . , b m (y)} that make v(x, y) ^ for every (x, y) e We thus have that 



J2ai(x)bi(y)=0iSf(x,y) = Q. 



8 = 1 



View the at and &j as 2™-dimensional vectors, let A be the 2™ x m matrix having 
the <Zj as columns, and let B be the m x 2" matrix having the bi as rows. Then 
(AB) xy — Y^ILi a i( x )bi(y), which is iff f(x, y) = 0. Thus AB is a nondeterministic 
matrix for /, and nrank(f) < rank(AB) < rank(A) < m. □ 
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Lemma 3.2 allows us to prove the following tight characterization. 
Theorem 3.3. NQcc(f) = [log nranfc(/)] + 1. 

Proof. Upper bound. Let r = nrank(f), and let M be a rank-r nondeterministic 
matrix for /. Let M T = UT.V be the singular value decomposition of the transpose 
of M [28] , so U and V are unitary, and £ is a diagonal matrix whose first r diagonal 
entries are positive real numbers and whose other diagonal entries are 0. Below we 
describe a one-round nondeterministic protocol for /, using [logr] + 1 qubits. 

First, Alice prepares the state l^) = c x T,V\x), where c x > is a normalizing 
real number that depends on x. Because only the first r diagonal entries of T, are 
nonzero, only the first r amplitudes of \<p x ) are nonzero, so \4> x ) can be compressed 
into [logr] qubits. Alice sends these qubits to Bob. Bob then applies U to \<p x ) and 
measures the resulting state. If he observes \y), then he puts 1 on the channel, and 
otherwise he puts there. The acceptance probability of this protocol is 

P(x,y) = \(y\U\^ x }\ 2 = c 2 x \(y\UEV\x)\ 2 = c 2 x \M T yx \ 2 = c 2 x \M xy \ 2 . 

Since M xy is nonzero iff f(x,y) = 1, P(x,y) will be positive iff f(x,y) = 1. Thus we 
have a nondeterministic quantum protocol for / with [log r] + 1 qubits of communi- 
cation. 

Lower bound. Consider a nondeterministic ^-qubit protocol for /. By Lemma 3.1, 
its final state on input [x, y) can be written as 

£ \Mx))\U)\Bi{v)). 

Without loss of generality, we assume the vectors Ai(x) and P>i{y) all have the same 
dimension d. Let S = {i e {0, l} 1 \ ig = 1}, and consider the part of the state that 
corresponds to output 1 (we drop the %t = 1 and the |-)-notation here), 

4>{x,y) = ^ j A i (x)®B i (y). 

ies 

Because the protocol has acceptance probability iff f(x,y) = 0, this vector <f>(x,y) 
will be the zero vector iff f(x,y) — 0. The previous lemma gives nrank(f) < \S\ = 
2 e - 1 ; hence log(nrank(f)) + 1 < NQcc(f). □ 

Note that any nondeterministic matrix for the equality function has nonzeros 
on its diagonal and zeros off-diagonal and hence has full rank. Thus we obtain 
NQcc(EQ) = n + 1. Similarly, a nondeterministic matrix for disjointness has full 
rank, because reversing the ordering of the columns in Mf gives an upper triangular 
matrix with nonzero elements on the diagonal. This gives tight bounds for the non- 
deterministic as well as for the exact setting, neither of which was known prior to this 
work. 

Corollary 3.4. Qcc E (EQ) = iVgcc(EQ) = n+l and Qcc E (DlS3) = TVQcc(DISJ) 
= n+ 1. 

3.3. Quantum-classical separation. To repeat, classically we have Ncc(f) = 
[log Cov 1 (f)] + 1, and quantumly we have NQcc(f) — [log nrank(f)] + 1. We now 
give a total function / with an exponential gap between Ncc(f) and NQcc(f). For 
n > 1, define / by 

f(x,y) = litt\xAy\^l. 
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We first show that the quantum complexity NQcc(f) is low. 

Theorem 3.5. For the above f, we have NQcc(f) < [log(n + 1)] + 1. 

Proof. By Theorem 3.3, it suffices to prove nrank{f) < n + 1. We will derive a 
low-rank nondeterministic matrix from the polynomial p of (2.1), using a technique 
from [43]. Let Mj be the matrix defined by Mi(x,y) = 1 if Xi = yi = 1 and by 
Mi(x,y) = otherwise. Notice that Mi has rank 1. Define a 2™ x 2" matrix M by 



Note that M(x,y) = p(x A y). Since p is a nondeterministic polynomial for the 
function which is 1 iff its input docs not have weight 1, it can be seen that M is 
a nondeterministic matrix for /. Because M is the sum of n + 1 rank-1 matrices, 
M itself has rank at most n + 1 . □ 

Now we show that the classical Ncc(f) is high (both for / and its complement). 
Theorem 3.6. For the above f, we have Ncc(f) G fi(n) and Ncc(f) >n-l. 
Proof. Let Ri, . . . , Rk be a minimal 1-cover for /. We use the following result 
from [36, Example 3.22 and section 4.6], which is essentially due to Razborov [45]. 
There exist sets A, B C {0, 1}" x {0, 1}™ and a probability distri- 
bution fi : {0,1}™ x {0,1}" -> [0,1] such that all (x,y) e A have 
\x A y\ = 0, all (x,y) € £? have [a; A y| = 1, (jl(A) = 3/4, and 
there are a,S > (independent of n) such that for all rectangles R, 
fi(R C\B)>a- (j,(R n A) - 2~ Sn . 
Since the Ri are 1-rectangles, they cannot contain elements from B. Hence n{Ri^B) = 
and n(R l fli) < 2- 5 "/a. However, since all elements of A are covered by the Ri, 
we have 



Therefore, Ncc(f) = [log A;] + 1 ^ (5n + log(3a/4). 

For the lower bound on Ncc(f), consider the set S = {(x, y) \ x\ = y\ = 1, Xi =yl 
for i > 1}. This S contains 2™ _1 elements, all of which are 1-inputs for /. Note that 
if (x, y) and (x',y') are two elements from S, then \x A y'\ > 1 or \x' Ay\ > 1, so a 
1-rectangle for / can contain at most one element of S. This shows that a minimal 
1-cover for / requires at least 2 n_1 rectangles and Ncc(f) >n—l. □ 

Another quantum-classical separation was obtained earlier by Massar et al. [37]. 
We include it for the sake of completeness. It shows that the nondeterministic com- 
plexity of the nonequality problem is extremely low, in sharp contrast to the equality 
problem itself. 

Theorem 3.7 (see [37]). For the nonequality problem on n bits, NQcc(NE) = 2 
versus iVcc(NE) = logn + 1. 

Proof. iVcc(NE) = logn + 1 is well known (see [36, Example 2.5]). Below we give 
the protocol for NE from [37]. 

Viewing her input number e [0,2™ — 1], Alice rotates a |0)-qubit over 

an angle x7r/2™, obtaining a qubit cos(a;7r/2™)|0) + sin(x7r/2")|l) which she sends to 
Bob. Bob rotates the qubit back over an angle j/7r/2™, obtaining cos((x — j/)7r/2™)|0) + 
sin((x — j/)7r/2™)|l). Bob now measures the qubit and sends back the observed bit. 
If x = y, then sin((a; — y)w/2 n ) = 0, so Bob will always send 0. If x ^ y, then 
sin((a; — y)ir/2 n ) ^ 0, so Bob will send 1 with positive probability. □ 
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In another direction, Klauck [34] showed that NQcc(f) is in general incomparable 
to bounded-error quantum communication complexity: the latter may be exponen- 
tially larger or smaller, depending on /. 

4. Future work. One of the main reasons for the usefulness of nondeterministic 
query and communication complexities in the classical case is the tight relation of these 
complexities with deterministic complexity. 

In the query complexity (decision tree) setting, we have the well-known bound 

max{A(/), A(J)} < D(f) < N(f)N(J). 
We conjecture that something similar holds in the quantum case: 

max{7VQ(/),7VQ(7)} < Q E (f) < £>(/) < 0(NQ(f)NQ(Jj). 

The ?-part is open and ties in with tightly embedding NQ(f) and ndeg(f) into the web 
of known relations between various complexity measures (section 2.6). This conjec- 
ture implies, for instance, D(f) € 0(deg(f) 2 ), which would be close to optimal [42]. 
Similarly, it would imply D(f) G 0(Qo(f) 2 ), which would be close to optimal as 
well [18]. In both cases, the currently best relation has a fourth power instead of a 
square. 

Similarly, for communication complexity, the following is known [36, section 2.11]: 

mzx{Ncc(f),Ncc(7)} < Dcc(f) < 0(Ncc(f)Ncc(f)). 

An analogous result might be true in the quantum setting, but we have been unable 
to prove it. So far, the best result in this direction is Klauck's observation that 
Dcc(f) = 0(Ncc(f)NQcc(J)) [33, Theorem 1]. 

Appendix. Comparison with alternative definitions. As mentioned in the 
introduction, three different definitions of nondeterministic quantum complexity are 
possible. We may consider the complexity of quantum algorithms that 

1. output 1 iff given an appropriate classical certificate (and such certificates 
must exist iff f(x) = 1), 

2. output 1 iff given an appropriate quantum certificate (and such certificates 
must exist iff f(x) = 1), or 

3. output 1 with positive probability iff f(x) = 1. 

The third definition is the one wc adopted for this paper. Clearly definition 2 is at 
least as strong as definition 1 in the sense that the complexity of a function according 
to definition 2 will be less than or equal to the complexity according to definition 1. In 
fact, in the setting of query complexity, these two definitions are equivalent, because 
without loss of generality the certificate can be taken to be the purported input. See 
Aaronson [1] for some recent results about "quantum certificate (query) complexity." 

Here we show that definition 3 is at least as strong as definition 2. We give the 
proof for the query complexity setting, but the same proof can be modified to work 
for communication complexity and other nonuniform settings as well. We then give 
an example in which the query complexity according to definition 3 is much less than 
according to definition 2. This shows that our NQ(f) is in fact the most powerful 
definition of nondeterministic quantum query complexity. 

We formalize definition 2 as follows. A T-query quantum verifier for / is a T- 
query quantum algorithm V together with a set C of m-qubit states, such that for all 
x € {0,1}" we have (1) if f(x) = 1, then there is a \<f> x ) £ C such that V x \(j) x ) has 
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acceptance probability 1; and (2) if f(x) — 0, then V x \<j>) has acceptance probability 
for every |0) € C. Informally, the set C contains all possible certificates: (1) for every 
1-input, there is a verifiable 1-certificate in C; and (2) for 0-inputs, there are not 
any. We do not put any constraints on C. However, note that the definition implies 
that if f(x) = for some x, then C cannot contain all m-qubit states; otherwise, 
\4>x) — Kc _1 |10) would be a 1-certificate in C even for x with f(x) = 0. 

We now prove that a T-query quantum verifier can be turned into a T-query 
nondctcrministic quantum algorithm according to our third definition. This shows 
that the third definition is at least as powerful as the second. In fact, this even 
holds if wc replace the acceptance probability 1 in clause (1) of the definition of a 
quantum verifier by just positive acceptance probability — in this case, both definitions 
are equivalent. 

Theorem A. 1. If there is a T-query quantum verifier V for f ', then NQ(f) <T. 
Proof. The verifier V and the associated set C satisfy the following: 

1. If f(x) — 1, then there is a | <f> x ) £ C such that V x \(j) x ) has acceptance proba- 
bility 1. 

2. If f(x) = 0, then V x \(j>) has acceptance probability for all \<f>) € C. 

Let X\ = {z | f(z) = 1}. For each z G X\, choose one specific 1-certificate \<f> z ) e C. 
Now let us consider some input x and see what happens if we run V x ® I (where I is 
the 2™ x 2 n identity operation) on the m + n-qubit state 



V x acts on only the first m qubits of \4>); the |z)-part remains unaffected. Therefore, 
running V x ® / on \<j>) gives the same acceptance probabilities as when we first ran- 
domly choose some z £ X\ and then apply V x to \<j) z ). In the case when f(x) = 0, 
this V x \<p z ) will have acceptance probability 0, so (V x ® I)\4>) will have acceptance 
probability as well. In the case when the input x is such that f(x) = 1, the specific 
certificate \4> z ) that we chose for this x will satisfy that 141^) has acceptance prob- 
ability 1. However, then (V x <g) I)\<j>) has acceptance probability at least l/|^i| > 0. 
Accordingly, (V x (&I)\(j>} has positive acceptance probability iff f(x) = 1. By prefixing 
V x ® / with a unitary transformation that maps |0) (of m + n qubits) to |</>), we have 
constructed a nondeterministic quantum algorithm for / with T queries. □ 

The above proof shows that our definition of NQ(f) is at least as strong as the 
certificate-verifier definition. Could it be that both definitions are in fact equivalent 
(i.e., yield the same complexity)? The function we used in section 2.5 shows that this 
is not the case. Consider again 



It satisfies NQ(f) = 1. On the other hand, if we take a T-query verifier for / and 
fix the certificate for the all-0 input, we obtain a T-query algorithm that always 
outputs 1 on the all-0 input and that outputs on all inputs of Hamming weight 1. 
The quantum search lower bounds [9, 6] immediately imply T = Q(y/n). This shows 
that our definition of NQ(f) is strictly more powerful than the certificate- verifying 
one. 
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